How Knocknoc removes attack surface
Just-in-time network allowlisting, through orchestration.
Simple, very effective and highly-scalable.
Fast to deploy without a big project, hosted on-premise/cloud.
Prevent attacks. Do more than just detect and respond.
Make your systems invisible
Knocknoc redefines security by dynamically implementing just-in-time network and web application allow-listing. It doesn’t just mitigate risks – it makes attack surfaces disappear. Prevent attacks. Do more than detect and respond.
- Zero day exploitation? Risk removed, or at least greatly reduced.
- Pre-auth exploitation? No longer possible. Attackers can’t reach your systems pre-auth.
- Vulnerability mapping? Prevented, your systems go dark.
- Internal or External? Both. Hide public systems, internal subnets, specific hosts or critical networks.
- Egress? North/South? East/west? Just in time traffic flows tied to an identity/login.
- Third parties and contractors? No software installation required, just a browser. Simple but effective.
Take a typical SSH bastion host:
- Without Knocknoc: SSH is exposed to the entire internet.
- With Knocknoc: An on-host agent dynamically opens the SSH port only for the authenticated user’s IP address – out of bad but centrally managed. Until then, no port or service is visible. Removed on logout or timeout.
Network-level exposure is then tied to your IDP – add MFA without changing SSH or interfering with existing, direct network access.
Hide networks, not just hosts, using Knocknoc
Just in time network access
- On premise control: A unique approach to network control infrastructure - novel, elegant, and highly effective.
- Use Your Existing Infrastructure: No additional devices, routes or latency; complete control over direct network access without relying on VPN-like services.
- Timed Access Control: Grant access only when users are authenticated and within predefined timeframes, access management made simple.
Flat internal network? Drop in protection, fast
Flat networks are a fact of life, network segmentation or micro-segmentation can be a big project and requires end-client installation. If you want to protect certain networks or assets fast, Knocknoc can drop in and control pre-authentication attack surface. Think of it as pico-segmentation.
- Knocknoc can be deployed in hours – not days, weeks or months
- No user installation – instant compatibility for unmanaged devices
- Link to your IDP/SAML, use the built-in authentication with MFA or combine them
- Contractor and third-party access – short lived account support
Knocknoc can provide an on-premise control layer with layer-7 filtering for HTTPs URI-level access control, tied to a Knocknoc login
On premise and internal, external and edge, or in public cloud – decentralised and direct network access, all managed centrally
